ci: declare workflow-level contents: read on 3 workflows#2853
ci: declare workflow-level contents: read on 3 workflows#2853arpitjain099 wants to merge 1 commit into
contents: read on 3 workflows#2853Conversation
Pins the default GITHUB_TOKEN to contents: read on the workflows in .github/workflows/ that don't call a GitHub API beyond the initial checkout. The other workflows in this directory are left implicit because they need write scopes that a maintainer is better placed to declare. Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow caps bound runtime authority irrespective of repo or org default, give drift protection if the default ever widens, and are credited per-file by the OpenSSF Scorecard Token-Permissions check. YAML validated locally with yaml.safe_load. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
|
|
|
Repository collaborators can run the JMH benchmark suite against this PR by commenting: Optional regression threshold override (Δ% on Time or Alloc/op; defaults to 10%): Only one benchmark run per PR is active at a time — issuing a new |
|
Only organization members can edit CI scripts. Sorry. |
3 participants
Pins the default
GITHUB_TOKENtocontents: readon 3 workflows in.github/workflows/that don't call a GitHub API beyond the initial checkout.The following files were left implicit because they reference
GITHUB_TOKEN/ use a write-scope action / trigger onpull_request_target. Those scopes are best declared by maintainers:build.yml.Why
CVE-2025-30066 (March 2025
tj-actions/changed-filessupply-chain compromise) exfiltratedGITHUB_TOKENfrom workflow logs. Pinning per workflow caps runtime authority irrespective of the repo or org default, gives drift protection if the default ever widens, and is credited per-file by the OpenSSF ScorecardToken-Permissionscheck.YAML validated locally with
yaml.safe_loadon each touched file.